Agent Access Without Shared Passwords: A Scoped Grant Pattern for Banks and Fintech
On October 22, Reuters and Axios reported that major US banks are restricting outside AI agents from customer accounts. As reported, customers share a username and password with an AI tool, the agent logs in, and the bank sees only the customer. Some agents tried actions the customer had not asked for. Most banks are moving towards read-only access for agents as a middle ground. Read-only is a…
Reuters and Axios reported on October 22 that major US banks are limiting access for outside AI agents to customer accounts. Customers currently share usernames and passwords with AI tools, which log in and banks only see the customer. Some agents performed actions the customer did not request. Most banks are now aiming for agents to have read-only access as a compromise.
However, the fundamental issue is that banks cannot differentiate agents from users. This article outlines a simple pattern to address this, using code I tested prior to drafting the piece. It is a learning example, not a finished product.
The problem with using shared logins lies in the fact that a password confirms an account holder's existence but provides no information about who is acting (person or software), on whose behalf, for what purpose, within what limits, or for how long. Once the agent uses the customer's login, all relevant details merge into a single name. The log records "customer logged in" without additional context. To resolve this, a four-rule pattern is proposed:
1. The agent possesses a distinct identity separate from the customer.
2. The customer issues a grant specifying the agent, actions, limits, expiry, and responsible company.
3. Any transaction requiring funds necessitates approval from the customer's app using a separate key.
4. Each log line identifies two actors: the acting agent and the customer it represents.
Step 1 involves creating helper functions and a signing method. The code uses base64 encoding, HMAC signing, JSON serialization, and timestamps. Bank and customer application keys are separate, held in a KMS or HSM in production. Two functions are defined: one to create a sealed grant and another to verify sealed approvals.
Step 2 explains how to issue a grant and obtain customer approval. A grant defines the scope, limits, and expiration date, signed by the bank. Approval involves the customer's app, signed using a distinct key, and never entered into the agent's prompt.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.